I want to send logs to logstash from the command line, so I thought using filebeat with input_type=stdin should work. Using ArchLinux, filebeat-5.1.1-1. My filebeat.yml:
filebeat.prospectors: - input_type: stdin output: logstash: hosts: ["localhost:5044"]
I can send a message using that prospector, and the message is indeed received by logstash, but filebeat does not terminate when the pipe is closed, so I cannot use it in an automated script. Example:
$ echo "message" | filebeat -c filebeat.yml -e -v 2016/12/20 09:42:49.649495 beat.go:267: INFO Home path: [/tmp] Config path: [/tmp] Data path: [/tmp/data] Logs path: [/tmp/logs] 2016/12/20 09:42:49.649539 beat.go:177: INFO Setup Beat: filebeat; Version: 5.1.1 2016/12/20 09:42:49.649600 logstash.go:90: INFO Max Retries set to: 3 2016/12/20 09:42:49.649657 outputs.go:106: INFO Activated logstash as output plugin. 2016/12/20 09:42:49.649732 publish.go:291: INFO Publisher name: latitude 2016/12/20 09:42:49.649876 logp.go:219: INFO Metrics logging every 30s 2016/12/20 09:42:49.649926 async.go:63: INFO Flush Interval set to: 1s 2016/12/20 09:42:49.650014 async.go:64: INFO Max Bulk Size set to: 2048 2016/12/20 09:42:49.650196 beat.go:207: INFO filebeat start running. 2016/12/20 09:42:49.650225 registrar.go:68: INFO No registry file found under: /tmp/data/registry. Creating a new registry file. 2016/12/20 09:42:49.650350 registrar.go:106: INFO Loading registrar data from /tmp/data/registry 2016/12/20 09:42:49.650376 registrar.go:131: INFO States Loaded from registrar: 0 2016/12/20 09:42:49.650396 crawler.go:34: INFO Loading Prospectors: 1 2016/12/20 09:42:49.650543 crawler.go:46: INFO Loading Prospectors completed. Number of prospectors: 1 2016/12/20 09:42:49.650558 crawler.go:61: INFO All prospectors are initialised and running with 0 states to persist 2016/12/20 09:42:49.650595 registrar.go:230: INFO Starting Registrar 2016/12/20 09:42:49.650619 sync.go:41: INFO Start sending events to output 2016/12/20 09:42:49.650650 spooler.go:63: INFO Starting spooler: spool_size: 2048; idle_timeout: 5s 2016/12/20 09:42:49.650664 prospecto`Preformatted text`r.go:111: INFO Starting prospector of type: stdin 2016/12/20 09:42:49.650791 log.go:84: INFO Harvester started for file: - 2016/12/20 09:42:49.650865 log.go:107: INFO End of file reached: -. Closing because close_eof is enabled. 2016/12/20 09:42:54.660838 state.go:112: ERR State for should have been dropped, but couldn't as state is not finished. [... process continues to run... ]
Am I doing it wrong? Thanks.